@atlasauth/pca-idjag 0.0.0-stage → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Atlas Authorization
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,67 @@
-# Temporary Holding Version
+# @atlasauth/pca-idjag
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+ID-JAG / OAuth Cross-App Access bridge for Proof-Carrying Authority (PCA). An ID-JAG (Identity Assertion Authorization Grant, `draft-ietf-oauth-identity-assertion-authz-grant`) is a JWT an enterprise identity provider mints so an agent app can act on a named user's behalf against one other app: `sub` is the human, `act` is the agent, `aud` is the single target app, and `scope` is the delegated authority. This package verifies such a grant, projects it onto a PCA principal and a signed root capability, and builds the two OAuth requests used in the flow (RFC 8693 token exchange to obtain a grant, RFC 7523 jwt-bearer to redeem one).
+
+## Install
+
+```sh
+npm i @atlasauth/pca-idjag @atlasauth/pca @atlasauth/pca-oidc
+```
+
+## Usage
+
+```ts
+import { generateKeyPair, encodeKey, verifyChain } from '@atlasauth/pca';
+import { verifyIdJag, idJagToCapability, tokenExchangeRequest, jwtBearerAssertion } from '@atlasauth/pca-idjag';
+
+// 1. Verify the ID-JAG. Fails closed (throws IdJagVerificationError) on any signature, issuer,
+//    audience, expiry, nonce, actor or scope problem.
+const grant = await verifyIdJag(idJagJwt, {
+  issuer: 'https://idp.example.com',
+  audience: 'https://resource.example.com',   // must be the single audience of the grant
+  jwksUri: 'https://idp.example.com/.well-known/jwks.json', // or `discover: true`, or an injected `key`
+  requiredScopes: ['calendar.read'],
+});
+grant.sub;     // the human
+grant.agent;   // the acting app (act.sub)
+grant.scopes;  // ['calendar.read', 'mail.send']
+
+// 2. Project it onto a signed PCA root capability: authority = scopes, holder = the agent's PCA key.
+const human = generateKeyPair();   // the human root key that signs the capability
+const agentKey = generateKeyPair();
+const { capability } = idJagToCapability(grant, {
+  principalSecret: human.secretKey,
+  principalPublic: encodeKey(human.publicKey),
+  holder: encodeKey(agentKey.publicKey),
+});
+verifyChain([capability], encodeKey(human.publicKey)); // { ok: true }
+
+// 3. The OAuth legs of the flow (plain request descriptions; you send them).
+const obtain = tokenExchangeRequest({
+  tokenEndpoint: 'https://idp.example.com/oauth2/token',
+  subjectToken: userIdToken,
+  audience: 'https://resource.example.com',
+  scope: ['calendar.read'],
+  clientId: 'agent-app-7',
+});
+const redeem = jwtBearerAssertion({
+  tokenEndpoint: 'https://resource.example.com/token',
+  assertion: idJagJwt,
+  scope: 'calendar.read',
+}).request;   // { url, method, headers, params, body }
+```
+
+## API
+
+- `verifyIdJag(jwt, options)` returns an `IdJagGrant`; throws `IdJagVerificationError` (with a `code`).
+- `idJagToPcaPrincipal(grant, opts?)`, `idJagToCapability(grant, opts)` map a grant to a PCA principal / signed root capability.
+- `readIdJagAuthority(cap)`, `readIdJagProvenance(cap)`, `isIdJagAuthorityCaveat`, `isIdJagProvenanceCaveat` read the caveats back.
+- `tokenExchangeRequest(opts)`, `jwtBearerAssertion(opts)` build the RFC 8693 / RFC 7523 requests; the `GRANT_TYPE_*`, `TOKEN_TYPE_*` and `CLIENT_ASSERTION_TYPE_JWT_BEARER` URN constants are exported.
+
+## Status
+
+The ID-JAG specification is an IETF draft and may change. JWT checks are delegated to `@atlasauth/pca-oidc`; only asymmetric algorithms are accepted by default. This package does not send any network request except the optional JWKS / discovery fetch. PCA cryptography has not been independently audited.
+
+## License
+
+MIT - see LICENSE

package/dist/index.d.ts

@@ -0,0 +1,244 @@
+import { type OidcConfirmation, type OidcIdTokenClaims, type OidcPrincipal, type OidcPrincipalOptions, type OidcVerificationErrorCode, type OidcVerifyKey } from '@atlasauth/pca-oidc';
+import { type CapSuiteOpts, type Capability, type Caveat } from '@atlasauth/pca';
+/** The RFC 8693 `act` (actor) claim identifying the AGENT the grant authorizes to act. */
+export interface IdJagActor {
+    /** The agent's identifier (required). */
+    sub: string;
+    [member: string]: unknown;
+}
+/** A verified ID-JAG grant. Every field here passed verification; a failure throws instead. */
+export interface IdJagGrant {
+    /** The IdP that asserted the grant (`iss`). */
+    iss: string;
+    /** The HUMAN the grant is about (`sub`). */
+    sub: string;
+    /** The AGENT the grant authorizes (`act`). */
+    actor: IdJagActor;
+    /** Convenience: `actor.sub`, the agent identifier. */
+    agent: string;
+    /** The SINGLE resource app the grant is for (`aud`). */
+    audience: string;
+    /** The delegated authority — the parsed `scope` (space-delimited) or `scopes` array. */
+    scopes: string[];
+    /** Issued-at (epoch seconds). */
+    iat: number;
+    /** Expiry (epoch seconds). */
+    exp: number;
+    /** JWT id, when present. */
+    jti?: string;
+    /** Round-tripped `nonce`, when the verifier required one. */
+    nonce?: string;
+    /** RFC 7800 `cnf` confirmation, when the grant binds a proof-of-possession key. */
+    cnf?: OidcConfirmation;
+    /** The verified OIDC base claims — fed straight to `oidcPrincipal` for the principal mapping. */
+    oidcClaims: OidcIdTokenClaims;
+}
+/** A stable classification of why ID-JAG verification failed (the OIDC codes plus ID-JAG-specific ones). */
+export type IdJagVerificationErrorCode = OidcVerificationErrorCode | 'actor' | 'scope' | 'grant';
+/** The error thrown for any ID-JAG verification failure. `code` classifies the cause. */
+export declare class IdJagVerificationError extends Error {
+    readonly name = "IdJagVerificationError";
+    readonly code: IdJagVerificationErrorCode;
+    constructor(code: IdJagVerificationErrorCode, message: string, options?: {
+        cause?: unknown;
+    });
+}
+export interface VerifyIdJagOptions {
+    /** Expected `iss` — the exact IdP issuer identifier. Required. */
+    issuer: string;
+    /**
+     * Expected `aud` — the SINGLE resource app this grant must be for. ID-JAG is single-audience: the token's
+     * `aud` must be exactly this value (a string, or a one-element array equal to it), else verification fails.
+     */
+    audience: string;
+    /** When set, the grant's `nonce` MUST be present and equal this value. */
+    nonce?: string;
+    /** When set, every scope here MUST be present in the grant, else verification fails. */
+    requiredScopes?: string[];
+    /** Clock skew tolerance in seconds (default 0). */
+    clockToleranceSec?: number;
+    /** When set, reject a grant whose `iat` is older than this many seconds. */
+    maxTokenAgeSec?: number;
+    /** Allowed JWS `alg`s. Defaults to the asymmetric set (never symmetric). */
+    algorithms?: string[];
+    /** Injectable key material (a key, JWK, or `createRemoteJWKSet` resolver). Preferred for tests. */
+    key?: OidcVerifyKey;
+    /** A JWKS endpoint URL to build a remote key set from (skips discovery). */
+    jwksUri?: string;
+    /** Resolve the JWKS endpoint from the issuer's `.well-known/openid-configuration` first. */
+    discover?: boolean;
+    /** Injectable `fetch` used for discovery (defaults to the global `fetch`). */
+    fetch?: typeof fetch;
+}
+/**
+ * Verify an ID-JAG JWT and return the parsed grant. Fails CLOSED: any signature / issuer / audience /
+ * expiry / nonce failure, a missing or malformed `act` agent claim, a missing `scope`, or a missing
+ * required scope throws {@link IdJagVerificationError}. The JWKS is injectable (`key` / `jwksUri` /
+ * `discover`); `key` lets tests verify entirely in-memory.
+ */
+export declare function verifyIdJag(jwt: string, opts: VerifyIdJagOptions): Promise<IdJagGrant>;
+/**
+ * Map a verified ID-JAG onto a PCA principal descriptor (the ROOT of a capability chain). Delegates to
+ * `@atlasauth/pca-oidc`'s `oidcPrincipal` on the grant's OIDC base claims, so the human `iss`+`sub` becomes
+ * a stable `principalId`, a signed `oidc_subject` caveat, and — when the grant binds a `cnf` Ed25519 key or
+ * the caller supplies one via `opts.principalPublic` — the b64u Ed25519 key the chain roots at.
+ */
+export declare function idJagToPcaPrincipal(grant: IdJagGrant, opts?: OidcPrincipalOptions): OidcPrincipal;
+/** The caveat recording the authority (scopes + audience) delegated by an ID-JAG. */
+export declare const IDJAG_AUTHORITY_CAVEAT = "idjag_authority";
+/** The caveat recording the ID-JAG provenance (who asserted it, for whom, by whom, when). */
+export declare const IDJAG_PROVENANCE_CAVEAT = "idjag_provenance";
+/** A capability caveat whose `scopes` ARE the root capability's authority. */
+export interface IdJagAuthorityCaveat extends Caveat {
+    type: typeof IDJAG_AUTHORITY_CAVEAT;
+    /** The delegated scopes — the authority of the root capability. */
+    scopes: string[];
+    /** The single resource audience the authority is for. */
+    aud: string;
+}
+/** A capability caveat recording the ID-JAG this root capability was projected from. */
+export interface IdJagProvenanceCaveat extends Caveat {
+    type: typeof IDJAG_PROVENANCE_CAVEAT;
+    /** The IdP that asserted the grant. */
+    iss: string;
+    /** The human subject. */
+    sub: string;
+    /** The agent (`act.sub`) the grant authorized. */
+    agent: string;
+    /** The single resource audience. */
+    aud: string;
+    /** Grant issued-at (epoch seconds). */
+    iat: number;
+    /** Grant expiry (epoch seconds). */
+    exp: number;
+    /** Grant JWT id, when present. */
+    jti?: string;
+}
+export interface IdJagToCapabilityOptions extends OidcPrincipalOptions {
+    /** The principal (human root) Ed25519 secret key that signs the root capability. */
+    principalSecret: Uint8Array;
+    /**
+     * The b64u Ed25519 principal (human root) public key the chain roots at. When the ID-JAG binds a `cnf`
+     * Ed25519 key, this MUST equal it (checked by `oidcPrincipal`), else a mismatch throws (fail closed).
+     */
+    principalPublic: string;
+    /** The b64u Ed25519 key the capability is bound to — the AGENT (`act`) holder. */
+    holder: string;
+    /** Optional per-hop signature suite for the root (default ed25519). */
+    suite?: CapSuiteOpts;
+    /** Optional extra caveats appended after the authority / provenance / subject caveats. */
+    extraCaveats?: Caveat[];
+}
+export interface IdJagCapabilityResult {
+    /** The signed root capability: authority = scopes, holder = agent, subject = human. */
+    capability: Capability;
+    /** The PCA principal descriptor derived from the grant. */
+    principal: OidcPrincipal;
+    /** The delegated scopes, == the authority caveat's scopes. */
+    scopes: string[];
+}
+/**
+ * Project a verified ID-JAG onto a signed PCA ROOT capability:
+ *   - authority = the grant's scopes (an {@link IdJagAuthorityCaveat});
+ *   - holder    = the agent (`act`) — `opts.holder`, the agent's PCA key;
+ *   - subject   = the human (`sub`) — recorded by the OIDC `oidc_subject` caveat;
+ *   - provenance= an {@link IdJagProvenanceCaveat} recording iss/sub/agent/aud/iat/exp/jti.
+ *
+ * The capability is rooted at `opts.principalPublic` (the human's root key) and signed by
+ * `opts.principalSecret`, so it anchors straight into `verifyChain([capability, ...], principalPublic)`.
+ */
+export declare function idJagToCapability(grant: IdJagGrant, opts: IdJagToCapabilityOptions): IdJagCapabilityResult;
+/** Narrowing guard for an {@link IdJagAuthorityCaveat}. */
+export declare function isIdJagAuthorityCaveat(cv: unknown): cv is IdJagAuthorityCaveat;
+/** Narrowing guard for an {@link IdJagProvenanceCaveat}. */
+export declare function isIdJagProvenanceCaveat(cv: unknown): cv is IdJagProvenanceCaveat;
+/** Read the {@link IdJagAuthorityCaveat} from a root capability, or null if absent/malformed. */
+export declare function readIdJagAuthority(cap: Capability): IdJagAuthorityCaveat | null;
+/** Read the {@link IdJagProvenanceCaveat} from a root capability, or null if absent/malformed. */
+export declare function readIdJagProvenance(cap: Capability): IdJagProvenanceCaveat | null;
+/** RFC 8693 token-exchange grant type. */
+export declare const GRANT_TYPE_TOKEN_EXCHANGE = "urn:ietf:params:oauth:grant-type:token-exchange";
+/** RFC 7523 JWT-bearer grant type (redeem an assertion for an access token). */
+export declare const GRANT_TYPE_JWT_BEARER = "urn:ietf:params:oauth:grant-type:jwt-bearer";
+/** The ID-JAG requested-token-type (draft-ietf-oauth-identity-assertion-authz-grant). */
+export declare const TOKEN_TYPE_ID_JAG = "urn:ietf:params:oauth:token-type:id-jag";
+/** RFC 8693 `id_token` token type. */
+export declare const TOKEN_TYPE_ID_TOKEN = "urn:ietf:params:oauth:token-type:id_token";
+/** RFC 8693 `access_token` token type. */
+export declare const TOKEN_TYPE_ACCESS_TOKEN = "urn:ietf:params:oauth:token-type:access_token";
+/** RFC 8693 generic `jwt` token type. */
+export declare const TOKEN_TYPE_JWT = "urn:ietf:params:oauth:token-type:jwt";
+/** RFC 7523 client-assertion type (for authenticating the client with a JWT). */
+export declare const CLIENT_ASSERTION_TYPE_JWT_BEARER = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+/** A ready-to-send `application/x-www-form-urlencoded` OAuth POST. */
+export interface OAuthFormRequest {
+    /** The token endpoint to POST to. */
+    url: string;
+    method: 'POST';
+    headers: Record<string, string>;
+    /** The form fields (empty values dropped). */
+    params: Record<string, string>;
+    /** The url-encoded request body (`params` serialized). */
+    body: string;
+}
+export interface TokenExchangeRequestOptions {
+    /** The IdP token endpoint the exchange is POSTed to. */
+    tokenEndpoint: string;
+    /** The subject token being exchanged (e.g. the end-user's ID token). */
+    subjectToken: string;
+    /** The subject token type (default `urn:...:id_token`). */
+    subjectTokenType?: string;
+    /** An optional actor token (the agent app's own token), when delegating. */
+    actorToken?: string;
+    /** The actor token type (default `urn:...:jwt` when `actorToken` is present). */
+    actorTokenType?: string;
+    /** The logical name of the target resource app the ID-JAG is FOR (RFC 8693 `audience`). */
+    audience?: string;
+    /** The resource URI the ID-JAG is for (RFC 8693 `resource`). */
+    resource?: string;
+    /** The scopes to request (string or array). */
+    scope?: string | string[];
+    /** The requested token type (default the ID-JAG type). */
+    requestedTokenType?: string;
+    /** The requesting client id (the agent app). */
+    clientId?: string;
+    /** Extra form fields to merge in. */
+    extra?: Record<string, string>;
+}
+/**
+ * Build the RFC 8693 token-exchange request that OBTAINS an ID-JAG from the IdP (the first XAA leg): the
+ * requesting app presents the user's subject token and asks the IdP to mint an ID-JAG for a single target
+ * resource app. Defaults `requested_token_type` to the ID-JAG type and `subject_token_type` to `id_token`.
+ */
+export declare function tokenExchangeRequest(opts: TokenExchangeRequestOptions): OAuthFormRequest;
+export interface JwtBearerAssertionOptions {
+    /** The target resource app's token endpoint the assertion is REDEEMED at. */
+    tokenEndpoint: string;
+    /** The assertion being presented — typically the ID-JAG obtained from the IdP. */
+    assertion: string;
+    /** The scopes to request at the resource app (string or array). */
+    scope?: string | string[];
+    /** The redeeming client id (the agent app). */
+    clientId?: string;
+    /** An optional RFC 7523 client-assertion JWT, to authenticate the client. */
+    clientAssertion?: string;
+    /** Extra form fields to merge in. */
+    extra?: Record<string, string>;
+}
+/** The structured RFC 7523 jwt-bearer representation of an ID-JAG being redeemed. */
+export interface JwtBearerAssertion {
+    grantType: typeof GRANT_TYPE_JWT_BEARER;
+    /** The assertion (the ID-JAG). */
+    assertion: string;
+    /** The requested scopes, space-delimited (when any). */
+    scope?: string;
+    /** The ready-to-send token request that redeems the assertion. */
+    request: OAuthFormRequest;
+}
+/**
+ * Build the RFC 7523 jwt-bearer representation + request that REDEEMS an ID-JAG at the target resource
+ * app's token endpoint for an access token (the second XAA leg): `grant_type=...:jwt-bearer` with the
+ * ID-JAG as the `assertion`. Pass `clientAssertion` to additionally authenticate the client with a JWT.
+ */
+export declare function jwtBearerAssertion(opts: JwtBearerAssertionOptions): JwtBearerAssertion;
+export type { OidcPrincipal, OidcPrincipalOptions, OidcConfirmation, OidcVerifyKey } from '@atlasauth/pca-oidc';

package/dist/index.js

@@ -0,0 +1,362 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CLIENT_ASSERTION_TYPE_JWT_BEARER = exports.TOKEN_TYPE_JWT = exports.TOKEN_TYPE_ACCESS_TOKEN = exports.TOKEN_TYPE_ID_TOKEN = exports.TOKEN_TYPE_ID_JAG = exports.GRANT_TYPE_JWT_BEARER = exports.GRANT_TYPE_TOKEN_EXCHANGE = exports.IDJAG_PROVENANCE_CAVEAT = exports.IDJAG_AUTHORITY_CAVEAT = exports.IdJagVerificationError = void 0;
+exports.verifyIdJag = verifyIdJag;
+exports.idJagToPcaPrincipal = idJagToPcaPrincipal;
+exports.idJagToCapability = idJagToCapability;
+exports.isIdJagAuthorityCaveat = isIdJagAuthorityCaveat;
+exports.isIdJagProvenanceCaveat = isIdJagProvenanceCaveat;
+exports.readIdJagAuthority = readIdJagAuthority;
+exports.readIdJagProvenance = readIdJagProvenance;
+exports.tokenExchangeRequest = tokenExchangeRequest;
+exports.jwtBearerAssertion = jwtBearerAssertion;
+/**
+ * `@atlasauth/pca-idjag` — an ID-JAG / OAuth Cross-App-Access (XAA) bridge for Proof-Carrying Authority.
+ *
+ * ID-JAG is the Identity Assertion Authorization Grant of
+ * {@link https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-assertion-authz-grant/ | draft-ietf-oauth-identity-assertion-authz-grant}
+ * (the standards-track form of Okta's "Cross-App Access"). An ID-JAG is a JWT the enterprise IdP mints so
+ * one app may act, on a named user's behalf, against ANOTHER app — scoped, time-boxed, single-audience:
+ *
+ *   iss  — the IdP that asserts the grant
+ *   sub  — the HUMAN the grant is about
+ *   act  — the AGENT/app doing the acting (RFC 8693 actor claim, `{ sub: "<agent>" , ... }`)
+ *   aud  — the SINGLE resource app the grant is for
+ *   scope— the authority being delegated
+ *
+ * That is exactly PCA's principal model: a human subject, an agent holder, a single audience, a scoped
+ * authority. This package verifies an ID-JAG and projects it onto a PCA principal + a signed root
+ * capability, so PCA drops into an Okta/Entra enterprise stack as the action verifier. It also builds the
+ * two OAuth request shapes the XAA flow uses — RFC 8693 token-exchange (to OBTAIN an ID-JAG) and RFC 7523
+ * jwt-bearer (to REDEEM one) — so PCA can both consume and participate in the flow.
+ *
+ * Verification REUSES `@atlasauth/pca-oidc`: `verifyIdToken` performs every crypto + registered-claim check
+ * (signature, `iss`, `aud`, `exp`, `iat`, `nonce`, injectable JWKS), and `oidcPrincipal` performs the
+ * identity → PCA-principal mapping. This module adds only the ID-JAG-specific rules (single audience, the
+ * required `act` agent claim, scope parsing) and the capability projection.
+ */
+const jose_1 = require("jose");
+const pca_oidc_1 = require("@atlasauth/pca-oidc");
+const pca_1 = require("@atlasauth/pca");
+/** The error thrown for any ID-JAG verification failure. `code` classifies the cause. */
+class IdJagVerificationError extends Error {
+    name = 'IdJagVerificationError';
+    code;
+    constructor(code, message, options) {
+        super(message, options);
+        this.code = code;
+    }
+}
+exports.IdJagVerificationError = IdJagVerificationError;
+/**
+ * Verify an ID-JAG JWT and return the parsed grant. Fails CLOSED: any signature / issuer / audience /
+ * expiry / nonce failure, a missing or malformed `act` agent claim, a missing `scope`, or a missing
+ * required scope throws {@link IdJagVerificationError}. The JWKS is injectable (`key` / `jwksUri` /
+ * `discover`); `key` lets tests verify entirely in-memory.
+ */
+async function verifyIdJag(jwt, opts) {
+    if (typeof jwt !== 'string' || jwt.length === 0) {
+        throw new IdJagVerificationError('invalid_token', 'verifyIdJag: jwt must be a non-empty string');
+    }
+    if (opts === null || typeof opts !== 'object') {
+        throw new IdJagVerificationError('config', 'verifyIdJag: opts is required');
+    }
+    if (typeof opts.issuer !== 'string' || opts.issuer.length === 0) {
+        throw new IdJagVerificationError('config', 'verifyIdJag: opts.issuer is required');
+    }
+    if (typeof opts.audience !== 'string' || opts.audience.length === 0) {
+        throw new IdJagVerificationError('config', 'verifyIdJag: opts.audience is required (ID-JAG is single-audience)');
+    }
+    // Reuse the OIDC verifier for every crypto + registered-claim check. It maps each jose failure onto a
+    // stable OIDC code; we re-wrap as an ID-JAG error preserving that code so callers see one error family.
+    let base;
+    try {
+        base = await (0, pca_oidc_1.verifyIdToken)(jwt, {
+            issuer: opts.issuer,
+            audience: opts.audience,
+            ...(opts.nonce !== undefined ? { nonce: opts.nonce } : {}),
+            ...(opts.clockToleranceSec !== undefined ? { clockToleranceSec: opts.clockToleranceSec } : {}),
+            ...(opts.maxTokenAgeSec !== undefined ? { maxTokenAgeSec: opts.maxTokenAgeSec } : {}),
+            ...(opts.algorithms !== undefined ? { algorithms: opts.algorithms } : {}),
+            ...(opts.key !== undefined ? { key: opts.key } : {}),
+            ...(opts.jwksUri !== undefined ? { jwksUri: opts.jwksUri } : {}),
+            ...(opts.discover !== undefined ? { discover: opts.discover } : {}),
+            ...(opts.fetch !== undefined ? { fetch: opts.fetch } : {}),
+        });
+    }
+    catch (cause) {
+        if (cause instanceof pca_oidc_1.OidcVerificationError) {
+            throw new IdJagVerificationError(cause.code, cause.message, { cause });
+        }
+        throw new IdJagVerificationError('invalid_token', 'ID-JAG verification failed', { cause });
+    }
+    // ID-JAG is SINGLE-AUDIENCE: the resource app must be the sole aud. `verifyIdToken` already confirmed the
+    // expected audience is PRESENT; here we additionally reject any extra audience (a multi-aud grant).
+    const audList = Array.isArray(base.aud) ? base.aud : [base.aud];
+    if (audList.length !== 1 || audList[0] !== opts.audience) {
+        throw new IdJagVerificationError('audience', 'ID-JAG must carry exactly one audience equal to the resource app (single-audience grant)');
+    }
+    // The signature is verified, so the payload is authentic: decode it to read the non-OIDC claims
+    // (`act`, `scope`, `jti`) that the OIDC claim projection does not surface.
+    let raw;
+    try {
+        raw = (0, jose_1.decodeJwt)(jwt);
+    }
+    catch (cause) {
+        throw new IdJagVerificationError('invalid_token', 'ID-JAG payload could not be decoded', { cause });
+    }
+    const actor = asActor(raw.act);
+    if (actor === undefined) {
+        throw new IdJagVerificationError('actor', 'ID-JAG is missing a well-formed "act" (agent) claim with a string "sub"');
+    }
+    const scopes = parseScopes(raw.scope, raw.scopes);
+    if (scopes === undefined) {
+        throw new IdJagVerificationError('scope', 'ID-JAG is missing the "scope" (or "scopes") claim');
+    }
+    if (Array.isArray(opts.requiredScopes)) {
+        const have = new Set(scopes);
+        for (const req of opts.requiredScopes) {
+            if (!have.has(req)) {
+                throw new IdJagVerificationError('scope', `ID-JAG does not grant the required scope "${req}"`);
+            }
+        }
+    }
+    const jti = typeof raw.jti === 'string' && raw.jti.length > 0 ? raw.jti : undefined;
+    return {
+        iss: base.iss,
+        sub: base.sub,
+        actor,
+        agent: actor.sub,
+        audience: opts.audience,
+        scopes,
+        iat: base.iat,
+        exp: base.exp,
+        ...(jti !== undefined ? { jti } : {}),
+        ...(base.nonce !== undefined ? { nonce: base.nonce } : {}),
+        ...(base.cnf !== undefined ? { cnf: base.cnf } : {}),
+        oidcClaims: base,
+    };
+}
+function asActor(v) {
+    if (v === null || typeof v !== 'object' || Array.isArray(v))
+        return undefined;
+    const rec = v;
+    const sub = rec.sub;
+    if (typeof sub !== 'string' || sub.length === 0)
+        return undefined;
+    return { ...rec, sub };
+}
+/** Parse the delegated authority from the `scope` (space-delimited string or array) / `scopes` claim. */
+function parseScopes(scope, scopes) {
+    if (typeof scope === 'string')
+        return scope.split(/\s+/).filter((s) => s.length > 0);
+    if (Array.isArray(scope))
+        return scope.filter((s) => typeof s === 'string' && s.length > 0);
+    if (Array.isArray(scopes))
+        return scopes.filter((s) => typeof s === 'string' && s.length > 0);
+    return undefined;
+}
+// ---------------------------------------------------------------------------------------------------
+// ID-JAG → PCA principal / capability
+// ---------------------------------------------------------------------------------------------------
+/**
+ * Map a verified ID-JAG onto a PCA principal descriptor (the ROOT of a capability chain). Delegates to
+ * `@atlasauth/pca-oidc`'s `oidcPrincipal` on the grant's OIDC base claims, so the human `iss`+`sub` becomes
+ * a stable `principalId`, a signed `oidc_subject` caveat, and — when the grant binds a `cnf` Ed25519 key or
+ * the caller supplies one via `opts.principalPublic` — the b64u Ed25519 key the chain roots at.
+ */
+function idJagToPcaPrincipal(grant, opts = {}) {
+    if (grant === null || typeof grant !== 'object')
+        throw new TypeError('idJagToPcaPrincipal: grant is required');
+    return (0, pca_oidc_1.oidcPrincipal)(grant.oidcClaims, opts);
+}
+/** The caveat recording the authority (scopes + audience) delegated by an ID-JAG. */
+exports.IDJAG_AUTHORITY_CAVEAT = 'idjag_authority';
+/** The caveat recording the ID-JAG provenance (who asserted it, for whom, by whom, when). */
+exports.IDJAG_PROVENANCE_CAVEAT = 'idjag_provenance';
+/**
+ * Project a verified ID-JAG onto a signed PCA ROOT capability:
+ *   - authority = the grant's scopes (an {@link IdJagAuthorityCaveat});
+ *   - holder    = the agent (`act`) — `opts.holder`, the agent's PCA key;
+ *   - subject   = the human (`sub`) — recorded by the OIDC `oidc_subject` caveat;
+ *   - provenance= an {@link IdJagProvenanceCaveat} recording iss/sub/agent/aud/iat/exp/jti.
+ *
+ * The capability is rooted at `opts.principalPublic` (the human's root key) and signed by
+ * `opts.principalSecret`, so it anchors straight into `verifyChain([capability, ...], principalPublic)`.
+ */
+function idJagToCapability(grant, opts) {
+    if (grant === null || typeof grant !== 'object')
+        throw new TypeError('idJagToCapability: grant is required');
+    if (opts === null || typeof opts !== 'object')
+        throw new TypeError('idJagToCapability: opts is required');
+    if (!(opts.principalSecret instanceof Uint8Array)) {
+        throw new TypeError('idJagToCapability: opts.principalSecret must be a Uint8Array');
+    }
+    if (typeof opts.principalPublic !== 'string' || opts.principalPublic.length === 0) {
+        throw new TypeError('idJagToCapability: opts.principalPublic is required');
+    }
+    if (typeof opts.holder !== 'string' || opts.holder.length === 0) {
+        throw new TypeError('idJagToCapability: opts.holder (the agent key) is required');
+    }
+    // Derive the principal — this also validates principalPublic against the grant's cnf key when present.
+    const principal = idJagToPcaPrincipal(grant, { principalPublic: opts.principalPublic });
+    const authority = {
+        type: exports.IDJAG_AUTHORITY_CAVEAT,
+        scopes: [...grant.scopes],
+        aud: grant.audience,
+    };
+    const provenance = {
+        type: exports.IDJAG_PROVENANCE_CAVEAT,
+        iss: grant.iss,
+        sub: grant.sub,
+        agent: grant.agent,
+        aud: grant.audience,
+        iat: grant.iat,
+        exp: grant.exp,
+        ...(grant.jti !== undefined ? { jti: grant.jti } : {}),
+    };
+    const caveats = [authority, provenance, principal.subjectCaveat, ...(opts.extraCaveats ?? [])];
+    const capability = (0, pca_1.mintRoot)({
+        principalSecret: opts.principalSecret,
+        principalPublic: opts.principalPublic,
+        holder: opts.holder,
+        caveats,
+        ...(opts.suite !== undefined ? { suite: opts.suite } : {}),
+    });
+    return { capability, principal, scopes: [...grant.scopes] };
+}
+/** Narrowing guard for an {@link IdJagAuthorityCaveat}. */
+function isIdJagAuthorityCaveat(cv) {
+    if (cv === null || typeof cv !== 'object')
+        return false;
+    const rec = cv;
+    return (rec.type === exports.IDJAG_AUTHORITY_CAVEAT &&
+        Array.isArray(rec.scopes) &&
+        rec.scopes.every((s) => typeof s === 'string') &&
+        typeof rec.aud === 'string' &&
+        rec.aud.length > 0);
+}
+/** Narrowing guard for an {@link IdJagProvenanceCaveat}. */
+function isIdJagProvenanceCaveat(cv) {
+    if (cv === null || typeof cv !== 'object')
+        return false;
+    const rec = cv;
+    return (rec.type === exports.IDJAG_PROVENANCE_CAVEAT &&
+        typeof rec.iss === 'string' &&
+        typeof rec.sub === 'string' &&
+        typeof rec.agent === 'string' &&
+        typeof rec.aud === 'string' &&
+        typeof rec.iat === 'number' &&
+        typeof rec.exp === 'number');
+}
+/** Read the {@link IdJagAuthorityCaveat} from a root capability, or null if absent/malformed. */
+function readIdJagAuthority(cap) {
+    const cv = cap?.caveats?.find((c) => c?.type === exports.IDJAG_AUTHORITY_CAVEAT);
+    return cv !== undefined && isIdJagAuthorityCaveat(cv) ? cv : null;
+}
+/** Read the {@link IdJagProvenanceCaveat} from a root capability, or null if absent/malformed. */
+function readIdJagProvenance(cap) {
+    const cv = cap?.caveats?.find((c) => c?.type === exports.IDJAG_PROVENANCE_CAVEAT);
+    return cv !== undefined && isIdJagProvenanceCaveat(cv) ? cv : null;
+}
+// ---------------------------------------------------------------------------------------------------
+// XAA flow: RFC 8693 token-exchange + RFC 7523 jwt-bearer request shapes
+// ---------------------------------------------------------------------------------------------------
+/** RFC 8693 token-exchange grant type. */
+exports.GRANT_TYPE_TOKEN_EXCHANGE = 'urn:ietf:params:oauth:grant-type:token-exchange';
+/** RFC 7523 JWT-bearer grant type (redeem an assertion for an access token). */
+exports.GRANT_TYPE_JWT_BEARER = 'urn:ietf:params:oauth:grant-type:jwt-bearer';
+/** The ID-JAG requested-token-type (draft-ietf-oauth-identity-assertion-authz-grant). */
+exports.TOKEN_TYPE_ID_JAG = 'urn:ietf:params:oauth:token-type:id-jag';
+/** RFC 8693 `id_token` token type. */
+exports.TOKEN_TYPE_ID_TOKEN = 'urn:ietf:params:oauth:token-type:id_token';
+/** RFC 8693 `access_token` token type. */
+exports.TOKEN_TYPE_ACCESS_TOKEN = 'urn:ietf:params:oauth:token-type:access_token';
+/** RFC 8693 generic `jwt` token type. */
+exports.TOKEN_TYPE_JWT = 'urn:ietf:params:oauth:token-type:jwt';
+/** RFC 7523 client-assertion type (for authenticating the client with a JWT). */
+exports.CLIENT_ASSERTION_TYPE_JWT_BEARER = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer';
+function formRequest(url, params) {
+    const clean = {};
+    for (const [k, v] of Object.entries(params)) {
+        if (typeof v === 'string' && v.length > 0)
+            clean[k] = v;
+    }
+    const search = new URLSearchParams(clean);
+    return {
+        url,
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
+        params: clean,
+        body: search.toString(),
+    };
+}
+/** Normalize a `scope` string or array to the space-delimited OAuth `scope` form, or undefined if empty. */
+function scopeParam(scope) {
+    if (scope === undefined)
+        return undefined;
+    const parts = (Array.isArray(scope) ? scope : scope.split(/\s+/)).filter((s) => typeof s === 'string' && s.length > 0);
+    return parts.length > 0 ? parts.join(' ') : undefined;
+}
+/**
+ * Build the RFC 8693 token-exchange request that OBTAINS an ID-JAG from the IdP (the first XAA leg): the
+ * requesting app presents the user's subject token and asks the IdP to mint an ID-JAG for a single target
+ * resource app. Defaults `requested_token_type` to the ID-JAG type and `subject_token_type` to `id_token`.
+ */
+function tokenExchangeRequest(opts) {
+    if (opts === null || typeof opts !== 'object')
+        throw new TypeError('tokenExchangeRequest: opts is required');
+    if (typeof opts.tokenEndpoint !== 'string' || opts.tokenEndpoint.length === 0) {
+        throw new TypeError('tokenExchangeRequest: opts.tokenEndpoint is required');
+    }
+    if (typeof opts.subjectToken !== 'string' || opts.subjectToken.length === 0) {
+        throw new TypeError('tokenExchangeRequest: opts.subjectToken is required');
+    }
+    const hasActor = typeof opts.actorToken === 'string' && opts.actorToken.length > 0;
+    return formRequest(opts.tokenEndpoint, {
+        grant_type: exports.GRANT_TYPE_TOKEN_EXCHANGE,
+        subject_token: opts.subjectToken,
+        subject_token_type: opts.subjectTokenType ?? exports.TOKEN_TYPE_ID_TOKEN,
+        requested_token_type: opts.requestedTokenType ?? exports.TOKEN_TYPE_ID_JAG,
+        ...(opts.audience !== undefined ? { audience: opts.audience } : {}),
+        ...(opts.resource !== undefined ? { resource: opts.resource } : {}),
+        ...(scopeParam(opts.scope) !== undefined ? { scope: scopeParam(opts.scope) } : {}),
+        ...(hasActor ? { actor_token: opts.actorToken, actor_token_type: opts.actorTokenType ?? exports.TOKEN_TYPE_JWT } : {}),
+        ...(opts.clientId !== undefined ? { client_id: opts.clientId } : {}),
+        ...(opts.extra ?? {}),
+    });
+}
+/**
+ * Build the RFC 7523 jwt-bearer representation + request that REDEEMS an ID-JAG at the target resource
+ * app's token endpoint for an access token (the second XAA leg): `grant_type=...:jwt-bearer` with the
+ * ID-JAG as the `assertion`. Pass `clientAssertion` to additionally authenticate the client with a JWT.
+ */
+function jwtBearerAssertion(opts) {
+    if (opts === null || typeof opts !== 'object')
+        throw new TypeError('jwtBearerAssertion: opts is required');
+    if (typeof opts.tokenEndpoint !== 'string' || opts.tokenEndpoint.length === 0) {
+        throw new TypeError('jwtBearerAssertion: opts.tokenEndpoint is required');
+    }
+    if (typeof opts.assertion !== 'string' || opts.assertion.length === 0) {
+        throw new TypeError('jwtBearerAssertion: opts.assertion is required');
+    }
+    const scope = scopeParam(opts.scope);
+    const hasClientAssertion = typeof opts.clientAssertion === 'string' && opts.clientAssertion.length > 0;
+    const request = formRequest(opts.tokenEndpoint, {
+        grant_type: exports.GRANT_TYPE_JWT_BEARER,
+        assertion: opts.assertion,
+        ...(scope !== undefined ? { scope } : {}),
+        ...(opts.clientId !== undefined ? { client_id: opts.clientId } : {}),
+        ...(hasClientAssertion
+            ? { client_assertion_type: exports.CLIENT_ASSERTION_TYPE_JWT_BEARER, client_assertion: opts.clientAssertion }
+            : {}),
+        ...(opts.extra ?? {}),
+    });
+    return {
+        grantType: exports.GRANT_TYPE_JWT_BEARER,
+        assertion: opts.assertion,
+        ...(scope !== undefined ? { scope } : {}),
+        request,
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AA6HA,kCA0FC;AA4BD,kDAGC;AAsED,8CA0CC;AAGD,wDAUC;AAGD,0DAYC;AAGD,gDAGC;AAGD,kDAGC;AAqFD,oDAqBC;AAiCD,gDA0BC;AAnjBD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,+BAAiC;AACjC,kDAU6B;AAC7B,wCAA2F;AA4C3F,yFAAyF;AACzF,MAAa,sBAAuB,SAAQ,KAAK;IAC7B,IAAI,GAAG,wBAAwB,CAAC;IACzC,IAAI,CAA6B;IAC1C,YAAY,IAAgC,EAAE,OAAe,EAAE,OAA6B;QAC1F,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAPD,wDAOC;AA8BD;;;;;GAKG;AACI,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,IAAwB;IACrE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,sBAAsB,CAAC,eAAe,EAAE,6CAA6C,CAAC,CAAC;IACnG,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAI,sBAAsB,CAAC,QAAQ,EAAE,+BAA+B,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,sBAAsB,CAAC,QAAQ,EAAE,sCAAsC,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,sBAAsB,CAAC,QAAQ,EAAE,oEAAoE,CAAC,CAAC;IACnH,CAAC;IAED,sGAAsG;IACtG,wGAAwG;IACxG,IAAI,IAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,IAAA,wBAAa,EAAC,GAAG,EAAE;YAC9B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,IAAI,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9F,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,gCAAqB,EAAE,CAAC;YAC3C,MAAM,IAAI,sBAAsB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,IAAI,sBAAsB,CAAC,eAAe,EAAE,4BAA4B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,0GAA0G;IAC1G,oGAAoG;IACpG,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;QACzD,MAAM,IAAI,sBAAsB,CAC9B,UAAU,EACV,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IAED,gGAAgG;IAChG,2EAA2E;IAC3E,IAAI,GAA4B,CAAC;IACjC,IAAI,CAAC;QACH,GAAG,GAAG,IAAA,gBAAS,EAAC,GAAG,CAA4B,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,sBAAsB,CAAC,eAAe,EAAE,qCAAqC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACtG,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,sBAAsB,CAAC,OAAO,EAAE,yEAAyE,CAAC,CAAC;IACvH,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,sBAAsB,CAAC,OAAO,EAAE,mDAAmD,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnB,MAAM,IAAI,sBAAsB,CAAC,OAAO,EAAE,6CAA6C,GAAG,GAAG,CAAC,CAAC;YACjG,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAEpF,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,KAAK;QACL,KAAK,EAAE,KAAK,CAAC,GAAG;QAChB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM;QACN,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,UAAU,EAAE,IAAI;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,CAAU;IACzB,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9E,MAAM,GAAG,GAAG,CAA4B,CAAC;IACzC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;IACpB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAClE,OAAO,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,CAAC;AACzB,CAAC;AAED,yGAAyG;AACzG,SAAS,WAAW,CAAC,KAAc,EAAE,MAAe;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrF,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzG,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3G,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,sGAAsG;AACtG,sCAAsC;AACtC,sGAAsG;AAEtG;;;;;GAKG;AACH,SAAgB,mBAAmB,CAAC,KAAiB,EAAE,OAA6B,EAAE;IACpF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAC;IAC/G,OAAO,IAAA,wBAAa,EAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,qFAAqF;AACxE,QAAA,sBAAsB,GAAG,iBAAiB,CAAC;AACxD,6FAA6F;AAChF,QAAA,uBAAuB,GAAG,kBAAkB,CAAC;AAuD1D;;;;;;;;;GASG;AACH,SAAgB,iBAAiB,CAAC,KAAiB,EAAE,IAA8B;IACjF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAC;IAC7G,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAC;IAC1G,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,YAAY,UAAU,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,SAAS,CAAC,8DAA8D,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,SAAS,CAAC,qDAAqD,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,SAAS,CAAC,4DAA4D,CAAC,CAAC;IACpF,CAAC;IAED,uGAAuG;IACvG,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,EAAE,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;IAExF,MAAM,SAAS,GAAyB;QACtC,IAAI,EAAE,8BAAsB;QAC5B,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;QACzB,GAAG,EAAE,KAAK,CAAC,QAAQ;KACpB,CAAC;IACF,MAAM,UAAU,GAA0B;QACxC,IAAI,EAAE,+BAAuB;QAC7B,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG,EAAE,KAAK,CAAC,QAAQ;QACnB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC;IACF,MAAM,OAAO,GAAa,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,aAAa,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;IAEzG,MAAM,UAAU,GAAG,IAAA,cAAQ,EAAC;QAC1B,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO;QACP,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3D,CAAC,CAAC;IAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,2DAA2D;AAC3D,SAAgB,sBAAsB,CAAC,EAAW;IAChD,IAAI,EAAE,KAAK,IAAI,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,GAAG,GAAG,EAAyD,CAAC;IACtE,OAAO,CACL,GAAG,CAAC,IAAI,KAAK,8BAAsB;QACnC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;QACzB,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QAC9C,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;QAC3B,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CACnB,CAAC;AACJ,CAAC;AAED,4DAA4D;AAC5D,SAAgB,uBAAuB,CAAC,EAAW;IACjD,IAAI,EAAE,KAAK,IAAI,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,GAAG,GAAG,EAAoH,CAAC;IACjI,OAAO,CACL,GAAG,CAAC,IAAI,KAAK,+BAAuB;QACpC,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;QAC3B,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;QAC3B,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;QAC7B,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;QAC3B,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;QAC3B,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAC5B,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,SAAgB,kBAAkB,CAAC,GAAe;IAChD,MAAM,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,KAAK,8BAAsB,CAAC,CAAC;IACzE,OAAO,EAAE,KAAK,SAAS,IAAI,sBAAsB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACpE,CAAC;AAED,kGAAkG;AAClG,SAAgB,mBAAmB,CAAC,GAAe;IACjD,MAAM,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,KAAK,+BAAuB,CAAC,CAAC;IAC1E,OAAO,EAAE,KAAK,SAAS,IAAI,uBAAuB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACrE,CAAC;AAED,sGAAsG;AACtG,yEAAyE;AACzE,sGAAsG;AAEtG,0CAA0C;AAC7B,QAAA,yBAAyB,GAAG,iDAAiD,CAAC;AAC3F,gFAAgF;AACnE,QAAA,qBAAqB,GAAG,6CAA6C,CAAC;AACnF,yFAAyF;AAC5E,QAAA,iBAAiB,GAAG,yCAAyC,CAAC;AAC3E,sCAAsC;AACzB,QAAA,mBAAmB,GAAG,2CAA2C,CAAC;AAC/E,0CAA0C;AAC7B,QAAA,uBAAuB,GAAG,+CAA+C,CAAC;AACvF,yCAAyC;AAC5B,QAAA,cAAc,GAAG,sCAAsC,CAAC;AACrE,iFAAiF;AACpE,QAAA,gCAAgC,GAAG,wDAAwD,CAAC;AAczG,SAAS,WAAW,CAAC,GAAW,EAAE,MAA0C;IAC1E,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC;IAC1C,OAAO;QACL,GAAG;QACH,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC5F,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;KACxB,CAAC;AACJ,CAAC;AAED,4GAA4G;AAC5G,SAAS,UAAU,CAAC,KAAoC;IACtD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvH,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC;AA2BD;;;;GAIG;AACH,SAAgB,oBAAoB,CAAC,IAAiC;IACpE,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAC;IAC7G,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,SAAS,CAAC,sDAAsD,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,SAAS,CAAC,qDAAqD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;IACnF,OAAO,WAAW,CAAC,IAAI,CAAC,aAAa,EAAE;QACrC,UAAU,EAAE,iCAAyB;QACrC,aAAa,EAAE,IAAI,CAAC,YAAY;QAChC,kBAAkB,EAAE,IAAI,CAAC,gBAAgB,IAAI,2BAAmB;QAChE,oBAAoB,EAAE,IAAI,CAAC,kBAAkB,IAAI,yBAAiB;QAClE,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,gBAAgB,EAAE,IAAI,CAAC,cAAc,IAAI,sBAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9G,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;KACtB,CAAC,CAAC;AACL,CAAC;AA4BD;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,IAA+B;IAChE,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,MAAM,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAC;IAC3G,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,SAAS,CAAC,oDAAoD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,kBAAkB,GAAG,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;IACvG,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,aAAa,EAAE;QAC9C,UAAU,EAAE,6BAAqB;QACjC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,kBAAkB;YACpB,CAAC,CAAC,EAAE,qBAAqB,EAAE,wCAAgC,EAAE,gBAAgB,EAAE,IAAI,CAAC,eAAe,EAAE;YACrG,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;KACtB,CAAC,CAAC;IACH,OAAO;QACL,SAAS,EAAE,6BAAqB;QAChC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,OAAO;KACR,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,59 @@
 {
   "name": "@atlasauth/pca-idjag",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.2.0",
+  "description": "ID-JAG / OAuth Cross-App-Access bridge for PCA: verify an identity-assertion authorization grant (sub=human, act=agent, scoped, single-audience) and map it to a PCA principal/capability; RFC 8693/7523 token-exchange.",
+  "keywords": [
+    "id-jag",
+    "cross app access",
+    "oauth",
+    "identity assertion",
+    "agent authorization",
+    "proof-carrying authority",
+    "pca",
+    "ai agents"
+  ],
+  "license": "MIT",
+  "homepage": "https://github.com/Atlas-Authorization/pca#readme",
+  "bugs": {
+    "url": "https://github.com/Atlas-Authorization/pca/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Atlas-Authorization/pca.git",
+    "directory": "packages/pca-idjag"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "dependencies": {
+    "jose": "^5.9.6",
+    "@atlasauth/pca": "0.2.0",
+    "@atlasauth/pca-oidc": "0.2.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.6.3",
+    "vitest": "^2.1.4"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run"
+  }
 }